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( TS//SI//NF) Introduction 

U.S. as World's Telecommunications Backbone 



Much of the world's 
communications flow 
through the U.S. 

A target's phone call, e-mail 
or chat will take the 
cheapest path, not the 
physically most direct 

path - you can't always 
predict the path. 

Your target's 
communications could 
easily be flowing into and 
through the U.S. 




International Internet Regional Bandwidth Capacity in 201 1 

Source: Telegcography Research 
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• Collection directly from the servers of these U.S. 
Service Providers: Microsoft, Yahoo, Google 
Facebook, PalTalk, AOL, Skype, YouTube 
V Apple. J— 
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(TS/7SI//NF) FAA702 Operations 

Why Use Both: PRISM vs. Upstream 






PRISM 

X X V X k_^» 1 - X 


Unstream 


DNI Selectors 


9 U.S. based service 
nroviders 


Worldwide 
±w sources 


JJJNK selectors 


fV\ Coming soon 


Worldwide 
sources 


Access to Stored 
Communications 
( S parch 1 







Real-Time Collection 
(Surveillance) 






"Abouts" Collection 


G 




Voice Collection 


Voice over IP 




Direct Relationship with 
Comms Providers 


(5° nl y through FBI 
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PRISM Collection Details 



Current Providers 



• Microsoft (Hotmail, etc.) 

• Google 

• Yahoo! 

• Facebook 

• PalTalk 

• YouTube 

• Skype 

• AOL 

• Apple 




What Will You Receive in Collection 
(Surveillance and Stored Comms)? 
It varies by provider. In general: 




E-mail 

Chat - video, voice 

Videos 

Photos 

Stored data 

VoIP 

File transfers 
Video Conferencing 

Notifications of target activity - logins, etc. 
Online Social Networking details 

Special Requests 



Complete list and details on PRISM web page: 

Go PRISMFAA TOP SliCRET//SI//ORCON//NOFORN 




2007 2008 2009 2010 2011 2012 2013 
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(ts//si//nf) FAA702 Reporting Highlight 

PRISM and STORMBREW Combine 
To Thwart \ 



SAME-DAY NTOC/FBI COLLABORATION 

PREVENTS 150GB EXFIL EVENT FROM CLEARED DEFENSE CONTRACTOR (CDC) 





« lie nr\i 



U.S. CDC sllsl 



TOC TIPS FBI TO 
MMINENT THREAT 



NTOC tips the 
FBI to the 
activity 





m HELPS CDC 
JMOVE IMPLANT 




The victim performed comprehend 
EXFILTRATION on the SAME 



on the inf< 



Iroc Discovi 



The FBI contacts the 
CDC and works with 
them to clean the 

twork, thus PBSfcVfeNTING 

ADVERSARY INTENT 
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PRISM Taskins Process 



Target Analyst inputs selectors into 
Unified Targeting Tool (UTT) 

Su rveillance ► ^ Pending Stored Co rnrns 




S2 FAA Adjudicators in Each Product Line 

Targeting Review/Validation 




Special FISA Oversight and Processing 
(SV4) 

Stored Co mm s Review /Validation 




Surveillance ► , 


r 






r < Pending Stored Comms 




Targeting and Mission Management (S343) 

Final Targeting Review and Release 





Unified Targeting Tool (UTT) 

1 



PRINTAURA; Site Selector 
Distribution Manager 



Providers 
(Google, 
Yahoo, etc.) 



Surveillance 



Targeting 
Selectors 



Collection 



■< Pendinq Stored Comms 



FBI 

Electronic Communications Surveillance Unit (ECSU) 
Research & Validate NO USPERs 



< Stored Comms Release 



FBI 

Data Intercept Technology Unit (DITU) 



Collection 



PINWALE, 
NUCLEON, 

etc. 
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PRISM Provider 
P1: Microsoft 
P2: Yahoo 
P3: Google 
P4: Facebook 
P5: PalTalk 
P6: YouTube 
P7: Skype 
P8: AOL 
PA: Apple 
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PRISM Case Notations 



P2ESQC1 20001 234 

\ j\ J \ )v j 




J 












Fixed trigraph, denotes 
PRISM source collection 


Year CASN established 
for selector 


Serial # 



Content Type 

A: Stored Comms (Search) 
B: IM (chat) 

C: RTN-EDC (real-time notification of an e-mail event such as a login 
or sent message) 

D: RTN-IM (real-time notification of a chat login or logout event) 
E: E-Mail 
F: VoIP 

G: Full (WebForum) 

H: OSN Messaging (photos, wallposts T activity, etc.) 
I: OSN Basic Subscriber Info 
J: Videos 

. (dot): Indicates multiple types 
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REPRISMFISA TIPS 




DYNAMIC PAGE ■ HIGHEST POSSIBLE CLASSIFICATION IS TOP SECRET SI TK ORCOn SOFQRv 




COUNTERTERRORISM 



2013-AprOS L3siO:28Z 



Click on the PRISM icon first 
( from the initial webpag y) 



PRISM ENTRII 





Last Load on Apr 05, 2013 at 12:22 PM GMT 

Check the tota l re cord status, click c>o this 

lAnli QUICK LI\KS| 



• See Enlire List (Cunenrj 

• See Enure LM (Current and Expired) 

• See NSA List 

• See New Retorts 

• Ownership C ount 

If the tot al count is much less tha n this. 

REPRISMFISA li. hdvmK liiuc^, E-MAIL 
the REPRISMFISA HELP DESK AT 



F1SA DOJFISA 



SEARCH 

The search form below can be used as a filter to see a oaroaJ li-st of 
records. 



SejichFoi: 



OfiND ©OR 



E«inr.il»n djys 
I'-tiontnonl 

f«ei I 



AND IN FORM Ti IEM 



Prism Current Entries 

of 23)4 > » Records per page; 50 v 



[ H wcowte i - 38 out of 117*73^^ ^ 

Clear SflUQltifrt | Click on calumnhwtm* *t> sort. * s column ■* notsort*ble. 
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